Grouper Users - Open Discussion List

["Bee-Lindgren, Bert" <>]

Hello,

Here is a quick answer; I can write a more complete one later if necessary. 

The answer is to define override the group selection _expression_ with a copy/paste of the default _expression_ with clauses added that compare names (or a custom attribute) to the patterns you don't want. 

Again, I'll provide an exact _expression_ when I'm at a computer. 

--Bert

On Mar 24, 2017, at 11:58 AM, Pregash J Devasagayam <> wrote:

Hi all,

 

We had thought we had seen a configuration setting that prevented groups with certain suffixes from being provisioned to a resource in the past, but can’t seem to find it now.  We are using the include/exclude group type on a number of groups, and we are in the middle of transitioning from our own in-house group provisioning logic to using pspng for our Active Directory.  In our testing we see that the _includes, _excludes, _systemOfRecord, and the _systemOfRecordAndIncludes groups all get provisioned to the active directory along with the final composite group.  We just want the final composite group to be provisioned and anything with those suffixes to be ignored. 

 

Any ideas?

 

Thanks,

 

Pregash Devasagayam

OIT Identity and Access Management

University of Colorado Boulder